MCP Deployment

Hosted deployment (Cloud Run)

The MCP server auto-deploys to Google Cloud Run on every push to main that modifies packages/mcp/**. The GitHub Actions workflow is at .github/workflows/deploy-mcp.yml.

How it works

1. Push to main triggers the workflow.
2. Docker image is built and pushed to Artifact Registry.
3. Cloud Run service oneclaw-mcp is updated with the new image.
4. The service is available at its Cloud Run URL (and at mcp.1claw.co if domain mapping is configured).

Infrastructure (Terraform)

The Cloud Run service and domain mapping are defined in infra/main.tf. To set up:

# In infra/terraform.tfvars
mcp_domain = "mcp.1claw.co"

Then run terraform apply. This creates:

• google_cloud_run_v2_service.mcp — The Cloud Run service with health checks, auto-scaling (0–5 instances), and the vault API URL injected as an environment variable.
• google_cloud_run_domain_mapping.mcp — Maps mcp.1claw.co to the service (requires a CNAME DNS record pointing to Cloud Run).

Environment variables (set automatically)

Variable	Value	Source
MCP_TRANSPORT	httpStream	Dockerfile default
PORT	8080	Dockerfile default
ONECLAW_BASE_URL	Vault Cloud Run URL	Terraform

Health check

The server exposes GET /health which returns 200 OK with body ✓ Ok. Cloud Run uses this for startup and liveness probes.

Self-hosting

The MCP server is a standard Node.js Docker container. You can deploy it anywhere that runs containers.

Docker

cd packages/mcp
docker build -t my-mcp-server .
docker run -p 8080:8080 \
  -e MCP_TRANSPORT=httpStream \
  -e ONECLAW_BASE_URL=https://api.1claw.co \
  my-mcp-server

Required configuration

Variable	Description
MCP_TRANSPORT	Set to httpStream for hosted mode
PORT	HTTP port (default: 8080)
ONECLAW_BASE_URL	Your vault API URL

Note: In hosted mode, auth credentials come from client request headers (Authorization, optionally X-Vault-ID and X-1Claw-Toolsets), not from environment variables. The server admits a session once per credential (memoised for 10 minutes), resolves the agent's entitlements at admission, offers only the entitled toolsets, and re-checks entitlements every 15 minutes and after any 403 from the vault.

To self-host a narrower server, build the split packages from the same tree: npm run build:packages in packages/mcp produces packages/vault/dist (@1claw/mcp-vault) and packages/guard/dist (@1claw/mcp-guard); each is pruned to its runtime import closure so the excluded domains are not on disk.